AI Cloud Detective
Stop Wasting Money
on Idle Cloud Resources
Argus finds what's wasting money across AWS, GCP, and Azure — idle, oversized, orphaned. Ranked findings with exact actions, straight to Slack. Or ask questions live.
What Argus finds¶
Stopped instances still charging
EC2, GCE, and Azure VMs that are stopped but still paying for reserved storage and EIPs.
Orphaned volumes and disks
EBS volumes, GCP Persistent Disks, and Azure Managed Disks with zero I/O for weeks.
Idle load balancers and NAT gateways
Resources processing zero bytes per day but billed by the hour.
Right-sizing opportunities
RDS db.r5.4xlarge at 4% CPU? EC2 m5.4xlarge with zero traffic? Argus names the current instance type and recommends the exact smaller tier — not "consider downsizing."
Over-provisioned clusters and caches
EKS, GKE, and AKS node groups, ElastiCache clusters, and Redshift nodes running at single-digit utilization — with specific node count and instance type recommendations.
Untagged and unowned resources
Resources with no owner tag that nobody knows about — prime deletion candidates.
Interactive chat mode
Ask questions in plain English: "Which RDS instances have been idle for 30+ days?" Argus investigates live and answers with costs and recommendations.
How it works¶
Discover
One API call to the cloud's asset inventory returns every billable resource across all regions — sorted by cost descending so the most expensive candidates are investigated first.
Investigate
A ReAct agent loop reasons like a human analyst — pulling 90-day metrics, actual spend, and last-activity timestamps only for resources where it matters. No hardcoded thresholds.
Report
Prioritized findings land in Slack with exact dollar amounts and specific actions — delete, right-size, or tag for review. Or skip the batch scan and ask questions live with argus chat.
Argus uses a ReAct agent loop — the AI decides what to investigate, calls the right tools in the right order, and reasons about idleness qualitatively. No hardcoded thresholds. No rules per resource type. The same brain works across all three clouds.
Example Slack report¶
Quick start¶
aws cloudformation deploy \
--template-file deploy/aws/single-account/template.yaml \
--stack-name Argus \
--capabilities CAPABILITY_IAM \
--parameter-overrides \
SlackWebhookUrl=https://hooks.slack.com/services/... \
PrimaryRegion=us-east-1
Deploys a Lambda + EventBridge rule (weekly scan) + IAM role. See AWS deployment guide for multi-account setup.
Design principles¶
| Principle | What it means | |
|---|---|---|
| Same brain, different hands | core/ is pure Python — zero cloud imports. Adapters are the only place SDKs live. | |
| AI drives the analysis | No hardcoded idle thresholds. Claude reasons about each resource in context. | |
| Least privilege always | Read-only IAM roles. No write permissions ever requested. | |
| Batch everything | One Cost Explorer call per scan. One Bedrock call per scan. Cost control by design. | |
| Fail loudly | Typed exceptions from adapters. No silent swallowing of errors. |
Total cost of a weekly scan
A full AWS scan across 100 resources costs roughly $0.25–0.50 using the Anthropic API (direct key) or ~$0.10 via AWS Bedrock. A single right-sizing recommendation (e.g. db.r5.4xlarge → db.r5.xlarge) typically saves 100–1,000× the scan cost per month.
Ready to find what's wasting money?
Clone, configure, deploy. First scan in under 5 minutes. Free and open source.
What's next¶
Resource Registry
A single declarative source of truth for every resource type — makes adding new types and clouds a one-file change.
Remediation v1
Act on findings directly from Slack — approve a deletion, stop an idle instance, release an unassociated IP.
Historical Tracking
Week-over-week comparison of findings — see what's new, what's resolved, and what keeps coming back.